51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c

General

Target

51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exe
Size

444KB
MD5

56e9b0fbe41b8a3e96fb28e02ca96a70
SHA1

bc04ac2c58f805b0c97b07076d1de4e0b981a1c3
SHA256

51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c
SHA512

519dbab949a697d3df3671781d90ab7eac5d726dd56c73a737290d7dff4f52500c27c8ecfa1feb712216b99192183ef4f307b0c61b533de9bfb1edae9259aad6
SSDEEP

12288:PFMeCb6yOIKgUnqN9ugSNkvm9f+MgvLwabghCE2SN7YDansz6J7yCXjmZfMc3edD:PXOSN7YDansWJ7yimS

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exelsass.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\lsass.exe	51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exe
File created	C:\Windows\SysWOW64\drivers\lsass.exe	lsass.exe

Executes dropped EXE 2 IoCs

Processes:

lsass.exe51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.~tmp

pid process

2456 lsass.exe
1692 51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.~tmp
Drops startup file 1 IoCs

Processes:

lsass.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~.pif lsass.exe
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

lsass.exe

description ioc process

File opened (read-only) \??\E: lsass.exe

pid	process
2456	lsass.exe
1692	51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.~tmp

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~.pif	lsass.exe

description	ioc	process
File opened (read-only)	\??\E:	lsass.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exelsass.exe

pid	process
3836	51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exe
3836	51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exe
2456	lsass.exe
2456	lsass.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exe

description	pid	process	target process
PID 3836 wrote to memory of 2456	3836	51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exe	lsass.exe
PID 3836 wrote to memory of 2456	3836	51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exe	lsass.exe
PID 3836 wrote to memory of 2456	3836	51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exe	lsass.exe
PID 3836 wrote to memory of 1692	3836	51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exe	51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.~tmp
PID 3836 wrote to memory of 1692	3836	51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exe	51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.~tmp
PID 3836 wrote to memory of 1692	3836	51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exe	51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.~tmp

C:\Users\Admin\AppData\Local\Temp\51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exe
"C:\Users\Admin\AppData\Local\Temp\51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\SysWOW64\drivers\lsass.exe
"C:\Windows\system32\drivers\lsass.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops startup file
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2456

C:\Users\Admin\AppData\Local\Temp\51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.~tmp
"C:\Users\Admin\AppData\Local\Temp\51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.~tmp "
2⤵
- Executes dropped EXE
PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.~tmp

Filesize
380KB

MD5
bee0aa5f2822bacc9069eec563f93e5f

SHA1
c590b7a8371c9f79549093d9c1c025a538556f3f

SHA256
edca6c4725146c4940c6d3747f123ce10d6656d5880e5c503a90bc0cd8d73bfc

SHA512
3dbc51731d1e436a11f3249f17719c95c55be3a8b293ec49c4f885b160f527ff4e31529acecd75c22c688b4e48aa1b7a89b39890bccd9b974f93cfccbfe5b575

Download Submit
C:\Users\Admin\AppData\Local\Temp\51b6f6d7cc053e21a13cd9e0832de51a65fbdc5d527737082b7b1b12417f936c.~tmp

Filesize
380KB

MD5
bee0aa5f2822bacc9069eec563f93e5f

SHA1
c590b7a8371c9f79549093d9c1c025a538556f3f

SHA256
edca6c4725146c4940c6d3747f123ce10d6656d5880e5c503a90bc0cd8d73bfc

SHA512
3dbc51731d1e436a11f3249f17719c95c55be3a8b293ec49c4f885b160f527ff4e31529acecd75c22c688b4e48aa1b7a89b39890bccd9b974f93cfccbfe5b575

Download Submit
C:\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
669ffd1dd6fb7a0e4ddbc3ad3b76507b

SHA1
372820d6b9350ad629a489d49876d8bd422b8f31

SHA256
7dc487e762e55ffa601480c4bc7948f85fcd4f025665ff599060ec1f81d7e986

SHA512
cd69694ad3316c768dbe0d1514060870568c67a50785b38d402eb16e94740c5ae351eb6d47284630a2505fac50c9777bedef85608571c85385b1b9c1f12d73f5

Download Submit
C:\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
669ffd1dd6fb7a0e4ddbc3ad3b76507b

SHA1
372820d6b9350ad629a489d49876d8bd422b8f31

SHA256
7dc487e762e55ffa601480c4bc7948f85fcd4f025665ff599060ec1f81d7e986

SHA512
cd69694ad3316c768dbe0d1514060870568c67a50785b38d402eb16e94740c5ae351eb6d47284630a2505fac50c9777bedef85608571c85385b1b9c1f12d73f5

Download Submit
memory/1692-135-0x0000000000000000-mapping.dmp

Download
memory/2456-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads